Compliance Risk Assessment Matrix - New York

COMPLIANCE RISK ASSESSMENT MATRIX -- NEW YORK

Company Name: [________________________________]
Assessment Period: [__/__/____] through [__/__/____]
Assessment Owner: [________________________________] (Chief Compliance Officer)
Approved By: [________________________________] (General Counsel / Audit Committee)
Document Version: [____]

TABLE OF CONTENTS

1. Executive Summary
2. Purpose and Objectives
3. Scope and Applicability
4. Regulatory Framework
5. Methodology Overview
6. Risk Taxonomy
7. Scoring Rubric
8. Roles and Responsibilities
9. Data Sources and Inputs
10. New York-Specific Risk Categories
11. Risk Assessment Matrix
12. Heat Map and Prioritization
13. Remediation Planning
14. Deliverables and Outputs
15. Review Cadence and Triggers
16. Governance and Oversight
17. Appendix A: Definitions
18. Appendix B: New York Regulatory Risk Inventory
19. Sources and References

1. EXECUTIVE SUMMARY

This Compliance Risk Assessment Matrix ("Matrix") provides a structured framework for identifying, assessing, and prioritizing compliance risks facing [________________________________] ("Company") with respect to operations in or connected to the State of New York. The Matrix aligns with the DOJ Evaluation of Corporate Compliance Programs, the COSO ERM Framework, and USSG 8B2.1.

Key Findings Summary:

2. PURPOSE AND OBJECTIVES

This Matrix serves to:

• Identify and catalog compliance risks across all business functions operating in New York
• Assess inherent risk levels based on likelihood and impact
• Evaluate the effectiveness of existing controls and calculate residual risk
• Prioritize remediation efforts based on risk severity and velocity
• Satisfy DOJ and USSG 8B2.1 expectations for periodic risk assessment
• Address New York's heightened regulatory environment, including DFS cybersecurity requirements and the SHIELD Act
• Inform the Board/Audit Committee of the compliance risk profile

3. SCOPE AND APPLICABILITY

This assessment covers:

☐ All business units, departments, and functions with New York operations or New York-resident customers/employees
☐ Compliance with federal laws applicable to New York operations
☐ Compliance with New York State and New York City statutes and regulations
☐ Third-party and vendor compliance risks
☐ Emerging risks (technology, regulatory changes, market dynamics)
☐ DFS-regulated entities: enhanced cybersecurity risk assessment per 23 NYCRR Part 500

4. REGULATORY FRAMEWORK

4.1 Federal Standards

• U.S. Sentencing Guidelines 8B2.1: Periodic risk assessment and seven minimum compliance program elements.
• DOJ Evaluation of Corporate Compliance Programs (September 2024 Update): Evaluates program design, resourcing, and effectiveness in practice.
• SOX Section 404 / COSO 2013: ICFR management assessment for public companies.
• COSO ERM Framework (2017): Five components for enterprise risk management.

4.2 New York State Law

• NY SHIELD Act (N.Y. Gen. Bus. Law §§ 899-aa, 899-bb): Section 899-bb requires a person or business that owns or licenses computerized data containing a New York resident's private information to maintain reasonable safeguards, with regulated-entity and small-business rules. Section 899-aa requires qualifying resident notice as expediently as possible, without unreasonable delay, and within 30 days after discovery. If any New York residents are to be notified, notify the Attorney General, Department of State, and State Police under § 899-aa(8)(a); notify DFS only if the person or business is a covered entity under 23 NYCRR 500.1, and notify consumer reporting agencies only when more than 5,000 residents are notified at one time. Enforcement and penalties depend on the violated provision and statutory predicates; do not use a blanket per-violation figure.
• 23 NYCRR Part 500 (DFS Cybersecurity Regulation): Applies to covered entities regulated by the NY Department of Financial Services. Requires written cybersecurity policy, CISO appointment, penetration testing, risk assessment, multi-factor authentication, encryption, incident response plan, third-party service provider security policy, and annual material-compliance certification or noncompliance acknowledgment. Amended in 2023 with additional requirements phased through 2025. Material penalties for non-compliance.
• N.Y. Gen. Bus. Law 349: Prohibits deceptive acts or practices in the conduct of any business, trade, or commerce. Private right of action; minimum $50 statutory damages.
• N.Y. Gen. Bus. Law 350: Prohibits false advertising. Private right of action with treble damages possible.
• N.Y. Exec. Law 296 (Human Rights Law): Prohibits employment discrimination based on age, race, creed, color, national origin, sexual orientation, gender identity, military status, sex, disability, predisposing genetic characteristics, familial status, marital status, and domestic violence victim status. Administered by the Division of Human Rights; no damages cap.
• N.Y. Lab. Law 201-g: Requires employers to maintain a sexual harassment prevention policy and conduct annual interactive training.
• N.Y. Lab. Law 740: Whistleblower protections; prohibits retaliation for reporting violations of law that create a substantial and specific danger to public health or safety, or that constitute healthcare fraud.

4.3 New York City Law (if applicable)

• NYC Human Rights Law (NYC Admin. Code 8-101 et seq.): Among the broadest anti-discrimination statutes in the nation. Covers additional protected categories and has lower standing requirements.
• NYC Local Law 144 (Automated Employment Decision Tools): Requires bias audits for AI/automated tools used in hiring or promotion decisions for NYC positions.
• NYC Conflicts of Interest Law (NYC Charter Ch. 68): Gift restrictions and ethical standards for City public servants.

5. METHODOLOGY OVERVIEW

5.1 Assessment Approach

Phase 1 -- Risk Identification: Catalog all compliance obligations through regulatory inventories, incident data, audit findings, and stakeholder interviews.

Phase 2 -- Risk Assessment: Evaluate inherent likelihood and impact; assess control effectiveness; calculate residual risk.

Phase 3 -- Prioritization: Rank risks by residual score; identify trends; flag emerging risks.

Phase 4 -- Remediation Planning: Action plans for high/critical risks with owners, deadlines, and metrics.

5.2 Assessment Cycle

• Full Assessment: Annually (Q1 of each fiscal year)
• Interim Updates: Triggered by material events (see Section 15)
• Continuous Monitoring: KRIs tracked monthly/quarterly
• DFS-Regulated Entities: Annual cybersecurity risk assessment per 23 NYCRR 500.09

6. RISK TAXONOMY

7. SCORING RUBRIC

7.1 Likelihood Scale (1-5)

7.2 Impact Scale (1-5)

7.3 Control Effectiveness Scale (1-5)

7.4 Residual Risk Calculation

Inherent Risk Score = Likelihood x Impact (1-25)

7.5 Risk Rating Thresholds

8. ROLES AND RESPONSIBILITIES

9. DATA SOURCES AND INPUTS

☐ Incident reports, complaints, and hotline data
☐ Regulatory examinations, inquiries, and enforcement actions (NY AG, DFS, DHR)
☐ Internal and external audit findings
☐ Penetration test and vulnerability assessment results (DFS-regulated)
☐ Product/service changes and new market entries
☐ Vendor risk assessments and due diligence
☐ KRIs and metrics dashboards
☐ Loss events and litigation history
☐ NY-specific regulatory updates (DFS bulletins, AG enforcement, NYC local laws)

10. NEW YORK-SPECIFIC RISK CATEGORIES

10.1 Data Privacy and Cybersecurity Risks

10.2 Employment and EEO Risks

10.3 Consumer Protection Risks

10.4 Financial Services Risks (DFS-Regulated Entities)

11. RISK ASSESSMENT MATRIX

Add additional rows for each identified risk.

12. HEAT MAP AND PRIORITIZATION

12.1 Risk Heat Map

IMPACT
  5 |  5   10  [15] [20] [25]
  4 |  4    8  [12] [16] [20]
  3 |  3    6    9  [12] [15]
  2 |  2    4    6    8   10
  1 |  1    2    3    4    5
    +----------------------------
       1    2    3    4    5
                LIKELIHOOD

12.2 Top Risks

13. REMEDIATION PLANNING

14. DELIVERABLES AND OUTPUTS

☐ Completed Risk Assessment Matrix
☐ Heat map visualization
☐ Top risks list with executive summary
☐ Remediation plans for High and Critical risks
☐ DFS annual certification documentation (if applicable)
☐ Board/Audit Committee summary
☐ KRI dashboard

15. REVIEW CADENCE AND TRIGGERS

• Annual Full Assessment: Q1 of each fiscal year
• DFS-Regulated: Annual cybersecurity risk assessment per 23 NYCRR 500.09
• Quarterly KRI Reviews
• Interim Triggers: Regulatory inquiry, data breach, new legislation, M&A, control failure, peer enforcement action, whistleblower report

16. GOVERNANCE AND OVERSIGHT

• Assessment Owner: Chief Compliance Officer (and CISO for cybersecurity components)
• Review Authority: General Counsel and Audit Committee
• Confidentiality: Subject to attorney-client privilege. Distribution approved by General Counsel.

APPENDIX A: DEFINITIONS

• Inherent Risk: Risk level before controls
• Control Effectiveness: Degree to which controls mitigate risk
• Residual Risk: Risk after controls
• KRI: Key Risk Indicator
• Risk Appetite: Acceptable risk level
• Risk Velocity: Speed of risk materialization

APPENDIX B: NEW YORK REGULATORY RISK INVENTORY

SOURCES AND REFERENCES

• U.S. Sentencing Guidelines 8B2.1 -- https://guidelines.ussc.gov/
• DOJ Evaluation of Corporate Compliance Programs (Sept. 2024) -- https://www.justice.gov/criminal/criminal-fraud/page/file/937501
• COSO ERM Framework (2017) -- https://www.coso.org/erm-framework
• NY SHIELD Act (N.Y. Gen. Bus. Law 899-aa, 899-bb) -- https://www.nysenate.gov/legislation/laws/GBS/899-BB
• 23 NYCRR Part 500 (DFS Cybersecurity) -- https://www.dfs.ny.gov/industry_guidance/cybersecurity
• N.Y. Gen. Bus. Law 349, 350
• N.Y. Exec. Law 296 (Human Rights Law)
• N.Y. Lab. Law 201-g, 740
• NYC Local Law 144 (AEDT)
• NY Commission on Ethics and Lobbying in Government -- https://ethics.ny.gov/

This document is a template provided for informational purposes only and does not constitute legal advice. It must be reviewed and customized by a qualified attorney licensed in New York before implementation.